# Regulatory Standards — SaaS Vendor Inventory

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 30(1)(d)**: Controller records of processing activities must include "the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations." This requires identifying all SaaS vendors processing personal data.

- **Article 28(1)**: The obligation to use only processors providing sufficient guarantees presupposes that the controller knows which processors are being used. Shadow IT directly undermines this obligation.

- **Article 5(2)**: The accountability principle requires the ability to demonstrate compliance — this includes demonstrating awareness and control of all processing relationships.

- **Article 24(1)**: Controllers must implement appropriate technical and organisational measures to demonstrate GDPR compliance. An accurate vendor inventory is foundational to this.

- **Article 25**: Data protection by design and by default includes incorporating privacy considerations into procurement decisions for SaaS applications.

### EDPB Guidelines 07/2020 on Controller and Processor Concepts

- **Paragraph 24**: The controller determines the purposes and means of processing. Using a SaaS application that processes personal data creates a controller-processor relationship regardless of whether formal procurement occurred.

- **Paragraph 85**: Controllers must assess processor sufficiency before engagement. Shadow IT bypasses this requirement entirely.

### EDPB Guidelines 04/2019 on Data Protection by Design and by Default

- **Paragraph 40-42**: Privacy by design requires that data protection considerations are integrated into procurement processes. Organizations should evaluate privacy implications before adopting any tool that processes personal data.

## Industry Standards

### ISO 27001:2022 — Annex A Controls

- **A.5.19 — Information security in supplier relationships**: Requires identification and documentation of suppliers with access to information assets.
- **A.5.21 — Managing information security in the ICT supply chain**: Extends supplier oversight through the technology supply chain.
- **A.5.23 — Information security for use of cloud services**: Specific controls for managing cloud service relationships.

### NIST Cybersecurity Framework 2.0

- **ID.AM-02**: Software, services, and systems are inventoried. Applies to SaaS applications.
- **ID.SC-04**: Suppliers and third-party partners are managed to reduce risk.

### CIS Controls v8

- **Control 2 — Inventory and Control of Software Assets**: Maintain an accurate inventory of all authorized and unauthorized software, including SaaS applications.
- **Control 15 — Service Provider Management**: Develop a process to evaluate service providers who hold sensitive data.

## Supervisory Authority Guidance

### CNIL — Shadow IT and GDPR Compliance

CNIL has emphasized that organizations cannot claim ignorance of processing by SaaS vendors adopted without formal approval. The controller's accountability obligation includes implementing technical measures (like CASB) to detect and manage shadow IT.

### Hamburg DPA — Cloud Service Guidance

The Hamburg DPA published guidance stating that controllers must maintain current inventories of all cloud services processing personal data and that failure to do so constitutes a breach of the accountability principle.

### ICO (UK) — Supply Chain Guidance

The ICO requires organizations to know "where personal data goes, who has access to it, and what happens to it at every stage." This explicitly extends to SaaS applications adopted informally by business units.